Problem/Motivation

Avoid ?email=&otp= on GET download (logs, Referer, history). Prefer POST body or short-lived exchange cookie after code entry.

GitHub: #43.

Proposed resolution

Redeem path that does not require long-lived secrets in the query string; document deprecation if breaking.

Remaining tasks

  • Implementation + tests + docs
  • Dual-venue close on ship

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Active » Fixed

Fixed on 1.x (merged PR #48). Confirmed complete in issue/doc sweep 2026-07-31.

https://github.com/Wilkes-Liberty/file_gate/pull/48

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Fixed » Closed (fixed)
jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented

Closed (fixed): OTP redeem via session cookie (no secrets in query) shipped on 1.x via GitHub PR #48 (GH #43). Next minor 1.5.0.

https://github.com/Wilkes-Liberty/file_gate/pull/48